Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-5458 | cits-support-svg\,-webp-media-and-ttf\,otf-file-upload (WordPress plugin) | The CITS Support svg, webp Media and TTF,OTF File Upload WordPress plugin before 3.0 does not sanitise uploaded SVG files, which could allow | medium | 5.4 | 0% |
| CVE-2024-0420 | mappress-maps-for-wordpress (WordPress plugin) | The MapPress Maps for WordPress plugin before 2.88.15 does not sanitize and escape the map title when outputting it back in the admin dashbo | medium | 5.4 | 0% |
| CVE-2024-2786 | happy-elementor-addons (WordPress plugin) | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, | medium | 5.4 | 0% |
| CVE-2024-11090 | restrict-content (WordPress plugin) | The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inc | medium | 5.3 | 0% |
| CVE-2024-10010 | learnpress (WordPress plugin) | The LearnPress WordPress plugin before 4.2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | 0% |
| CVE-2024-4274 | essential-real-estate (WordPress plugin) | The Essential Real Estate plugin for WordPress is vulnerable to unauthorized loss of data due to insufficient validation on the remove_prope | medium | 4.3 | 0% |
| CVE-2025-1322 | wp-recall (WordPress plugin) | The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to Information Exposure in all versions up to, and | medium | 4.3 | 0% |
| CVE-2025-3059 | drupal/profile_private | The security team is marking this project unsupported. There is a known security issue with the project that has not bee | unknown | 0.0 | 0% |
| CVE-2026-45034 | phpoffice/phpspreadsheet | PHPSpreadsheet has a patch bypass for CVE-2026-34084 | critical | 0.0 | 0% |
| CVE-2026-72786 | craftcms/cms | Craft CMS: Arbitrary user password reset leading to administrator account takeover | high | 0.0 | 0% |
| CVE-2021-4447 | essential-addons-for-elementor-lite (WordPress plugin) | The Essential Addons for Elementor plugin for WordPress is vulnerable to privilege escalation in versions up to and including 4.6.4 due to | high | 8.8 | 0% |
| CVE-2025-2110 | wp-compress-image-optimizer (WordPress plugin) | The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to unauthorized access, modification, and loss | high | 8.8 | 0% |
| CVE-2026-33039 | wwbn/avideo | AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy | high | 8.6 | 0% |
| CVE-2024-13656 | click-mag (WordPress theme) | The Click Mag - Viral WordPress News Magazine/Blog Theme theme for WordPress is vulnerable to unauthorized modification of data that can lea | high | 8.1 | 0% |
| CVE-2026-54180 | backpack/crud | Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR) | high | 7.6 | 0% |
| CVE-2026-59932 | phpoffice/phpspreadsheet | PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion | high | 7.5 | 0% |
| CVE-2026-59933 | phpoffice/phpspreadsheet | PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion | high | 7.5 | 0% |
| CVE-2024-8106 | wpextended (WordPress plugin) | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, | medium | 6.5 | 0% |
| CVE-2023-5073 | iframe-forms (WordPress plugin) | The iframe forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'iframe' shortcode in versions up to, and includi | medium | 6.4 | 0% |
| CVE-2024-10222 | svg-support (WordPress plugin) | The SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, | medium | 6.4 | 0% |
| CVE-2023-4757 | staff-\/-employee-business-directory-for-active-directory (WordPress plugin) | The Staff / Employee Business Directory for Active Directory WordPress plugin before 1.2.3 does not sanitize and escape data returned from t | medium | 5.4 | 0% |
| CVE-2024-0978 | jonradio-private-site (WordPress plugin) | The My Private Site plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.14 via th | medium | 5.3 | 0% |
| CVE-2024-1472 | wp-maintenance (WordPress plugin) | The WP Maintenance plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.1.6 via the REST API. | medium | 5.3 | 0% |
| CVE-2024-1475 | coming-soon-maintenance-mode (WordPress plugin) | The Coming Soon Maintenance Mode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, | medium | 5.3 | 0% |
| CVE-2022-40963 | wp-pagebuilder (WordPress plugin) | Multiple Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerabilities in WP Page Builder plugin <= 1.2.6 on WordPress. | medium | 4.8 | 0% |
| CVE-2023-1839 | product-addons-\&-fields-for-woocommerce (WordPress plugin) | The Product Addons & Fields for WooCommerce WordPress plugin before 32.0.6 does not sanitize and escape some of its setting fields, which co | medium | 4.8 | 0% |
| CVE-2024-4217 | shortcodes-ultimate (WordPress plugin) | The shortcodes-ultimate-pro WordPress plugin before 7.1.5 does not properly escape some of its shortcodes' settings, making it possible for | medium | 4.7 | 0% |
| CVE-2023-6924 | photo-gallery (WordPress plugin) | The Photo Gallery by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widgets in versions up to, and including, 1 | medium | 4.4 | 0% |
| CVE-2026-54713 | cakephp/queue | cakephp/queue's Incomplete Comparison in getUniqueId vulnerable to collisions | low | 3.7 | 0% |
| CVE-2026-55790 | craftcms/cms | Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget | high | 0.0 | 0% |
| CVE-2025-3876 | sms-alert (WordPress plugin) | The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to insufficient user OTP vali | high | 8.8 | 0% |
| CVE-2025-69214 | devcode-it/openstamanager | OpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint) | high | 8.8 | 0% |
| CVE-2023-2550 | thorsten/phpmyfaq | Cross Site Scripting in thorsten/phpmyfaq | high | 8.2 | 0% |
| CVE-2022-4409 | thorsten/phpmyfaq | phpMyFAQ has insecure HTTP cookies | high | 7.5 | 0% |
| CVE-2024-10261 | paid-member-subscriptions (WordPress plugin) | The The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable | high | 7.3 | 0% |
| CVE-2024-9581 | shortcodes-anywhere (WordPress plugin) | The Shortcodes AnyWhere plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0.1. Thi | high | 7.3 | 0% |
| CVE-2022-47145 | blockonomics (WordPress plugin) | Reflected Cross-Site Scripting (XSS) vulnerability in Blockonomics WordPress Bitcoin Payments – Blockonomics plugin <= 3.5.7 versions. | high | 7.1 | 0% |
| CVE-2023-7151 | product-enquiry-for-woocommerce (WordPress plugin) | The Product Enquiry for WooCommerce WordPress plugin before 3.2 does not sanitise and escape the page parameter before outputting it back in | medium | 6.1 | 0% |
| CVE-2022-3881 | wptools (WordPress plugin) | The WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log WordPress plugin b | medium | 5.7 | 0% |
| CVE-2024-12071 | evergreen-content-poster (WordPress plugin) | The Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media plugin for WordPress is vulnerable to unauthorized l | medium | 5.3 | 0% |
| CVE-2021-3680 | showdoc/showdoc | Inadequate Encryption Strength in showdoc | medium | 4.9 | 0% |
| CVE-2024-47536 | starcitizentools/citizen-skin | starcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" field | medium | 4.6 | 0% |
| CVE-2022-40310 | rate-my-post (WordPress plugin) | Authenticated (subscriber+) Race Condition vulnerability in Rate my Post – WP Rating System plugin <= 3.3.4 at WordPress allows attackers to | medium | 4.3 | 0% |
| CVE-2024-10533 | wp-whatsapp (WordPress plugin) | The WP Chat App plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the ajax_install | medium | 4.3 | 0% |
| CVE-2025-4419 | hot-random-image (WordPress plugin) | The Hot Random Image plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.9.2 via the 'path' paramet | medium | 4.3 | 0% |
| CVE-2026-84307 | filament/filament | Filament: Password validity disclosure for accounts denied panel access on login page | low | 3.7 | 0% |
| CVE-2026-113442 | codingms/fluid-form | TYPO3-EXT-SA-2026-033: Cross-Site Scripting in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form) | unknown | 0.0 | 0% |
| CVE-2026-113712 | cachethq/cachet | Cachet has Stored XSS in Incident Component | medium | 0.0 | 0% |
| CVE-2023-2921 | short-url (WordPress plugin) | The Short URL WordPress plugin through 1.6.8 does not properly sanitise and escape a parameter before using it in SQL statement, leading to | high | 8.8 | 0% |
| CVE-2026-56341 | wwbn/avideo | AVideo: Unauthenticated Access to Payment Log DataTables Endpoints Exposes Transaction Data, PayPal Tokens, and User Financial Records | high | 7.5 | 0% |